Security
The gate is in your threat model. We designed for that.
A system that sits in your execution path and holds your audit evidence deserves more scrutiny than any other tool you run. These are the properties it was built around — each one checkable in the source.
Your network boundary is the boundary
AnchorGate is self-hosted — Docker Compose or Helm, in your VPC. Raw prompts, PII, and decision traces are processed inside your own network and never reach an AnchorGate cloud, because there isn’t one.
Signed, not asserted
Decision events are signed with ECDSA P-256 over RFC 8785 canonical JSON. The signature covers a stored canonical text payload — not a database row — so verification never depends on how the database serializes things back.
Append-only by trigger, tamper-evident by math
A database trigger blocks updates and deletes on the ledger. But the real guarantee is cryptographic: even someone with direct database access can’t alter a record without breaking its signature.
Fail-closed where it matters
In full mode, no policy evaluation means no egress. Telemetry is the deliberate opposite — fail-open with a durable local spool — because losing observability should never take down your product, and blocking traffic silently should never be possible.
Keys belong in a KMS
A development signing key is auto-generated on first boot so the quickstart just works. Production deployments load the signing key from a KMS or HSM — the private key never sits in application config.
MCP hardening is opinionated
Authorized tool-call targets match byte-for-byte — wildcards are deliberately unsupported, because wildcards are how DNS rebinding and token harvesting happen. Shell invocations are rejected outright. Task tokens are single-use and burn on first use.
MCP security
An MCP gateway that assumes the token will leak
One stolen token is all an MCP integration needs to become an exfiltration path. Long-lived credentials and wildcard allowlists don’t stop it — so AnchorGate’s MCP gateway is built as if the leak already happened.
- Exact-string target allowlists — wildcards deliberately unsupported, because wildcards are how tokens get harvested.
- Shell invocations rejected outright. The posture is deny-by-default: if a target isn’t on the list byte-for-byte, the call doesn’t happen.
- TBAC single-use, task-bound tokens that burn on first use — a stolen token is useless outside its task, and useless twice.
Responsible disclosure
Found a vulnerability? We want to hear about it. Email security@anchorgate.ai and we'll respond within two business days.
Audit us before you deploy us
The fastest way to evaluate a security claim is to read the code that makes it. Every mechanism on this page — the signing, the trigger, the target matching — has a file you can open.
Read the sourceor email hello@anchorgate.ai